1 /*
2 * Copyright (c) 2013-2021, ARM Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stdbool.h>
9 #include <string.h>
10
11 #include <platform_def.h>
12
13 #include <arch.h>
14 #include <arch_helpers.h>
15 #include <arch_features.h>
16 #include <bl31/interrupt_mgmt.h>
17 #include <common/bl_common.h>
18 #include <context.h>
19 #include <lib/el3_runtime/context_mgmt.h>
20 #include <lib/el3_runtime/pubsub_events.h>
21 #include <lib/extensions/amu.h>
22 #include <lib/extensions/mpam.h>
23 #include <lib/extensions/sme.h>
24 #include <lib/extensions/spe.h>
25 #include <lib/extensions/sve.h>
26 #include <lib/extensions/sys_reg_trace.h>
27 #include <lib/extensions/trbe.h>
28 #include <lib/extensions/trf.h>
29 #include <lib/extensions/twed.h>
30 #include <lib/utils.h>
31
32 static void manage_extensions_secure(cpu_context_t *ctx);
33
34 /*******************************************************************************
35 * Context management library initialisation routine. This library is used by
36 * runtime services to share pointers to 'cpu_context' structures for the secure
37 * and non-secure states. Management of the structures and their associated
38 * memory is not done by the context management library e.g. the PSCI service
39 * manages the cpu context used for entry from and exit to the non-secure state.
40 * The Secure payload dispatcher service manages the context(s) corresponding to
41 * the secure state. It also uses this library to get access to the non-secure
42 * state cpu context pointers.
43 * Lastly, this library provides the api to make SP_EL3 point to the cpu context
44 * which will used for programming an entry into a lower EL. The same context
45 * will used to save state upon exception entry from that EL.
46 ******************************************************************************/
cm_init(void)47 void __init cm_init(void)
48 {
49 /*
50 * The context management library has only global data to intialize, but
51 * that will be done when the BSS is zeroed out
52 */
53 }
54
55 /*******************************************************************************
56 * The following function initializes the cpu_context 'ctx' for
57 * first use, and sets the initial entrypoint state as specified by the
58 * entry_point_info structure.
59 *
60 * The security state to initialize is determined by the SECURE attribute
61 * of the entry_point_info.
62 *
63 * The EE and ST attributes are used to configure the endianness and secure
64 * timer availability for the new execution context.
65 *
66 * To prepare the register state for entry call cm_prepare_el3_exit() and
67 * el3_exit(). For Secure-EL1 cm_prepare_el3_exit() is equivalent to
68 * cm_el1_sysregs_context_restore().
69 ******************************************************************************/
cm_setup_context(cpu_context_t * ctx,const entry_point_info_t * ep)70 void cm_setup_context(cpu_context_t *ctx, const entry_point_info_t *ep)
71 {
72 unsigned int security_state;
73 u_register_t scr_el3;
74 el3_state_t *state;
75 gp_regs_t *gp_regs;
76 u_register_t sctlr_elx, actlr_elx;
77
78 assert(ctx != NULL);
79
80 security_state = GET_SECURITY_STATE(ep->h.attr);
81
82 /* Clear any residual register values from the context */
83 zeromem(ctx, sizeof(*ctx));
84
85 /*
86 * SCR_EL3 was initialised during reset sequence in macro
87 * el3_arch_init_common. This code modifies the SCR_EL3 fields that
88 * affect the next EL.
89 *
90 * The following fields are initially set to zero and then updated to
91 * the required value depending on the state of the SPSR_EL3 and the
92 * Security state and entrypoint attributes of the next EL.
93 */
94 scr_el3 = read_scr();
95 scr_el3 &= ~(SCR_NS_BIT | SCR_RW_BIT | SCR_FIQ_BIT | SCR_IRQ_BIT |
96 SCR_ST_BIT | SCR_HCE_BIT);
97
98 #if ENABLE_RME
99 /* When RME support is enabled, clear the NSE bit as well. */
100 scr_el3 &= ~SCR_NSE_BIT;
101 #endif /* ENABLE_RME */
102
103 /*
104 * SCR_NS: Set the security state of the next EL.
105 */
106 if (security_state == NON_SECURE) {
107 scr_el3 |= SCR_NS_BIT;
108 }
109
110 #if ENABLE_RME
111 /* Check for realm state if RME support enabled. */
112 if (security_state == REALM) {
113 scr_el3 |= SCR_NS_BIT | SCR_NSE_BIT | SCR_EnSCXT_BIT;
114 }
115 #endif /* ENABLE_RME */
116
117 /*
118 * SCR_EL3.RW: Set the execution state, AArch32 or AArch64, for next
119 * Exception level as specified by SPSR.
120 */
121 if (GET_RW(ep->spsr) == MODE_RW_64) {
122 scr_el3 |= SCR_RW_BIT;
123 }
124 /*
125 * SCR_EL3.ST: Traps Secure EL1 accesses to the Counter-timer Physical
126 * Secure timer registers to EL3, from AArch64 state only, if specified
127 * by the entrypoint attributes.
128 */
129 if (EP_GET_ST(ep->h.attr) != 0U) {
130 scr_el3 |= SCR_ST_BIT;
131 }
132
133 /*
134 * If FEAT_HCX is enabled, enable access to HCRX_EL2 by setting
135 * SCR_EL3.HXEn.
136 */
137 #if ENABLE_FEAT_HCX
138 scr_el3 |= SCR_HXEn_BIT;
139 #endif
140
141 #if RAS_TRAP_LOWER_EL_ERR_ACCESS
142 /*
143 * SCR_EL3.TERR: Trap Error record accesses. Accesses to the RAS ERR
144 * and RAS ERX registers from EL1 and EL2 are trapped to EL3.
145 */
146 scr_el3 |= SCR_TERR_BIT;
147 #endif
148
149 #if !HANDLE_EA_EL3_FIRST
150 /*
151 * SCR_EL3.EA: Do not route External Abort and SError Interrupt External
152 * to EL3 when executing at a lower EL. When executing at EL3, External
153 * Aborts are taken to EL3.
154 */
155 scr_el3 &= ~SCR_EA_BIT;
156 #endif
157
158 #if FAULT_INJECTION_SUPPORT
159 /* Enable fault injection from lower ELs */
160 scr_el3 |= SCR_FIEN_BIT;
161 #endif
162
163 #if !CTX_INCLUDE_PAUTH_REGS
164 /*
165 * If the pointer authentication registers aren't saved during world
166 * switches the value of the registers can be leaked from the Secure to
167 * the Non-secure world. To prevent this, rather than enabling pointer
168 * authentication everywhere, we only enable it in the Non-secure world.
169 *
170 * If the Secure world wants to use pointer authentication,
171 * CTX_INCLUDE_PAUTH_REGS must be set to 1.
172 */
173 if (security_state == NON_SECURE) {
174 scr_el3 |= SCR_API_BIT | SCR_APK_BIT;
175 }
176 #endif /* !CTX_INCLUDE_PAUTH_REGS */
177
178 #if !CTX_INCLUDE_MTE_REGS || ENABLE_ASSERTIONS
179 /* Get Memory Tagging Extension support level */
180 unsigned int mte = get_armv8_5_mte_support();
181 #endif
182 /*
183 * Enable MTE support. Support is enabled unilaterally for the normal
184 * world, and only for the secure world when CTX_INCLUDE_MTE_REGS is
185 * set.
186 */
187 #if CTX_INCLUDE_MTE_REGS
188 assert((mte == MTE_IMPLEMENTED_ELX) || (mte == MTE_IMPLEMENTED_ASY));
189 scr_el3 |= SCR_ATA_BIT;
190 #else
191 /*
192 * When MTE is only implemented at EL0, it can be enabled
193 * across both worlds as no MTE registers are used.
194 */
195 if ((mte == MTE_IMPLEMENTED_EL0) ||
196 /*
197 * When MTE is implemented at all ELs, it can be only enabled
198 * in Non-Secure world without register saving.
199 */
200 (((mte == MTE_IMPLEMENTED_ELX) || (mte == MTE_IMPLEMENTED_ASY)) &&
201 (security_state == NON_SECURE))) {
202 scr_el3 |= SCR_ATA_BIT;
203 }
204 #endif /* CTX_INCLUDE_MTE_REGS */
205
206 #ifdef IMAGE_BL31
207 /*
208 * SCR_EL3.IRQ, SCR_EL3.FIQ: Enable the physical FIQ and IRQ routing as
209 * indicated by the interrupt routing model for BL31.
210 *
211 * TODO: The interrupt routing model code is not updated for REALM
212 * state. Use the default values of IRQ = FIQ = 0 for REALM security
213 * state for now.
214 */
215 if (security_state != REALM) {
216 scr_el3 |= get_scr_el3_from_routing_model(security_state);
217 }
218 #endif
219
220 /* Save the initialized value of CPTR_EL3 register */
221 write_ctx_reg(get_el3state_ctx(ctx), CTX_CPTR_EL3, read_cptr_el3());
222 if (security_state == SECURE) {
223 manage_extensions_secure(ctx);
224 }
225
226 /*
227 * SCR_EL3.HCE: Enable HVC instructions if next execution state is
228 * AArch64 and next EL is EL2, or if next execution state is AArch32 and
229 * next mode is Hyp.
230 * SCR_EL3.FGTEn: Enable Fine Grained Virtualization Traps under the
231 * same conditions as HVC instructions and when the processor supports
232 * ARMv8.6-FGT.
233 * SCR_EL3.ECVEn: Enable Enhanced Counter Virtualization (ECV)
234 * CNTPOFF_EL2 register under the same conditions as HVC instructions
235 * and when the processor supports ECV.
236 */
237 if (((GET_RW(ep->spsr) == MODE_RW_64) && (GET_EL(ep->spsr) == MODE_EL2))
238 || ((GET_RW(ep->spsr) != MODE_RW_64)
239 && (GET_M32(ep->spsr) == MODE32_hyp))) {
240 scr_el3 |= SCR_HCE_BIT;
241
242 if (is_armv8_6_fgt_present()) {
243 scr_el3 |= SCR_FGTEN_BIT;
244 }
245
246 if (get_armv8_6_ecv_support()
247 == ID_AA64MMFR0_EL1_ECV_SELF_SYNCH) {
248 scr_el3 |= SCR_ECVEN_BIT;
249 }
250 }
251
252 /* Enable S-EL2 if the next EL is EL2 and security state is secure */
253 if ((security_state == SECURE) && (GET_EL(ep->spsr) == MODE_EL2)) {
254 if (GET_RW(ep->spsr) != MODE_RW_64) {
255 ERROR("S-EL2 can not be used in AArch32.");
256 panic();
257 }
258
259 scr_el3 |= SCR_EEL2_BIT;
260 }
261
262 /*
263 * FEAT_AMUv1p1 virtual offset registers are only accessible from EL3
264 * and EL2, when clear, this bit traps accesses from EL2 so we set it
265 * to 1 when EL2 is present.
266 */
267 if (is_armv8_6_feat_amuv1p1_present() &&
268 (el_implemented(2) != EL_IMPL_NONE)) {
269 scr_el3 |= SCR_AMVOFFEN_BIT;
270 }
271
272 /*
273 * Initialise SCTLR_EL1 to the reset value corresponding to the target
274 * execution state setting all fields rather than relying of the hw.
275 * Some fields have architecturally UNKNOWN reset values and these are
276 * set to zero.
277 *
278 * SCTLR.EE: Endianness is taken from the entrypoint attributes.
279 *
280 * SCTLR.M, SCTLR.C and SCTLR.I: These fields must be zero (as
281 * required by PSCI specification)
282 */
283 sctlr_elx = (EP_GET_EE(ep->h.attr) != 0U) ? SCTLR_EE_BIT : 0U;
284 if (GET_RW(ep->spsr) == MODE_RW_64) {
285 sctlr_elx |= SCTLR_EL1_RES1;
286 } else {
287 /*
288 * If the target execution state is AArch32 then the following
289 * fields need to be set.
290 *
291 * SCTRL_EL1.nTWE: Set to one so that EL0 execution of WFE
292 * instructions are not trapped to EL1.
293 *
294 * SCTLR_EL1.nTWI: Set to one so that EL0 execution of WFI
295 * instructions are not trapped to EL1.
296 *
297 * SCTLR_EL1.CP15BEN: Set to one to enable EL0 execution of the
298 * CP15DMB, CP15DSB, and CP15ISB instructions.
299 */
300 sctlr_elx |= SCTLR_AARCH32_EL1_RES1 | SCTLR_CP15BEN_BIT
301 | SCTLR_NTWI_BIT | SCTLR_NTWE_BIT;
302 }
303
304 #if ERRATA_A75_764081
305 /*
306 * If workaround of errata 764081 for Cortex-A75 is used then set
307 * SCTLR_EL1.IESB to enable Implicit Error Synchronization Barrier.
308 */
309 sctlr_elx |= SCTLR_IESB_BIT;
310 #endif
311
312 /* Enable WFE trap delay in SCR_EL3 if supported and configured */
313 if (is_armv8_6_twed_present()) {
314 uint32_t delay = plat_arm_set_twedel_scr_el3();
315
316 if (delay != TWED_DISABLED) {
317 /* Make sure delay value fits */
318 assert((delay & ~SCR_TWEDEL_MASK) == 0U);
319
320 /* Set delay in SCR_EL3 */
321 scr_el3 &= ~(SCR_TWEDEL_MASK << SCR_TWEDEL_SHIFT);
322 scr_el3 |= ((delay & SCR_TWEDEL_MASK)
323 << SCR_TWEDEL_SHIFT);
324
325 /* Enable WFE delay */
326 scr_el3 |= SCR_TWEDEn_BIT;
327 }
328 }
329
330 /*
331 * Store the initialised SCTLR_EL1 value in the cpu_context - SCTLR_EL2
332 * and other EL2 registers are set up by cm_prepare_el3_exit() as they
333 * are not part of the stored cpu_context.
334 */
335 write_ctx_reg(get_el1_sysregs_ctx(ctx), CTX_SCTLR_EL1, sctlr_elx);
336
337 /*
338 * Base the context ACTLR_EL1 on the current value, as it is
339 * implementation defined. The context restore process will write
340 * the value from the context to the actual register and can cause
341 * problems for processor cores that don't expect certain bits to
342 * be zero.
343 */
344 actlr_elx = read_actlr_el1();
345 write_ctx_reg((get_el1_sysregs_ctx(ctx)), (CTX_ACTLR_EL1), (actlr_elx));
346
347 /*
348 * Populate EL3 state so that we've the right context
349 * before doing ERET
350 */
351 state = get_el3state_ctx(ctx);
352 write_ctx_reg(state, CTX_SCR_EL3, scr_el3);
353 write_ctx_reg(state, CTX_ELR_EL3, ep->pc);
354 write_ctx_reg(state, CTX_SPSR_EL3, ep->spsr);
355
356 /*
357 * Store the X0-X7 value from the entrypoint into the context
358 * Use memcpy as we are in control of the layout of the structures
359 */
360 gp_regs = get_gpregs_ctx(ctx);
361 memcpy(gp_regs, (void *)&ep->args, sizeof(aapcs64_params_t));
362 }
363
364 /*******************************************************************************
365 * Enable architecture extensions on first entry to Non-secure world.
366 * When EL2 is implemented but unused `el2_unused` is non-zero, otherwise
367 * it is zero.
368 ******************************************************************************/
manage_extensions_nonsecure(bool el2_unused,cpu_context_t * ctx)369 static void manage_extensions_nonsecure(bool el2_unused, cpu_context_t *ctx)
370 {
371 #if IMAGE_BL31
372 #if ENABLE_SPE_FOR_LOWER_ELS
373 spe_enable(el2_unused);
374 #endif
375
376 #if ENABLE_AMU
377 amu_enable(el2_unused, ctx);
378 #endif
379
380 #if ENABLE_SME_FOR_NS
381 /* Enable SME, SVE, and FPU/SIMD for non-secure world. */
382 sme_enable(ctx);
383 #elif ENABLE_SVE_FOR_NS
384 /* Enable SVE and FPU/SIMD for non-secure world. */
385 sve_enable(ctx);
386 #endif
387
388 #if ENABLE_MPAM_FOR_LOWER_ELS
389 mpam_enable(el2_unused);
390 #endif
391
392 #if ENABLE_TRBE_FOR_NS
393 trbe_enable();
394 #endif /* ENABLE_TRBE_FOR_NS */
395
396 #if ENABLE_SYS_REG_TRACE_FOR_NS
397 sys_reg_trace_enable(ctx);
398 #endif /* ENABLE_SYS_REG_TRACE_FOR_NS */
399
400 #if ENABLE_TRF_FOR_NS
401 trf_enable();
402 #endif /* ENABLE_TRF_FOR_NS */
403 #endif
404 }
405
406 /*******************************************************************************
407 * Enable architecture extensions on first entry to Secure world.
408 ******************************************************************************/
manage_extensions_secure(cpu_context_t * ctx)409 static void manage_extensions_secure(cpu_context_t *ctx)
410 {
411 #if IMAGE_BL31
412 #if ENABLE_SME_FOR_NS
413 #if ENABLE_SME_FOR_SWD
414 /*
415 * Enable SME, SVE, FPU/SIMD in secure context, secure manager must
416 * ensure SME, SVE, and FPU/SIMD context properly managed.
417 */
418 sme_enable(ctx);
419 #else /* ENABLE_SME_FOR_SWD */
420 /*
421 * Disable SME, SVE, FPU/SIMD in secure context so non-secure world can
422 * safely use the associated registers.
423 */
424 sme_disable(ctx);
425 #endif /* ENABLE_SME_FOR_SWD */
426 #elif ENABLE_SVE_FOR_NS
427 #if ENABLE_SVE_FOR_SWD
428 /*
429 * Enable SVE and FPU in secure context, secure manager must ensure that
430 * the SVE and FPU register contexts are properly managed.
431 */
432 sve_enable(ctx);
433 #else /* ENABLE_SVE_FOR_SWD */
434 /*
435 * Disable SVE and FPU in secure context so non-secure world can safely
436 * use them.
437 */
438 sve_disable(ctx);
439 #endif /* ENABLE_SVE_FOR_SWD */
440 #endif /* ENABLE_SVE_FOR_NS */
441 #endif /* IMAGE_BL31 */
442 }
443
444 /*******************************************************************************
445 * The following function initializes the cpu_context for a CPU specified by
446 * its `cpu_idx` for first use, and sets the initial entrypoint state as
447 * specified by the entry_point_info structure.
448 ******************************************************************************/
cm_init_context_by_index(unsigned int cpu_idx,const entry_point_info_t * ep)449 void cm_init_context_by_index(unsigned int cpu_idx,
450 const entry_point_info_t *ep)
451 {
452 cpu_context_t *ctx;
453 ctx = cm_get_context_by_index(cpu_idx, GET_SECURITY_STATE(ep->h.attr));
454 cm_setup_context(ctx, ep);
455 }
456
457 /*******************************************************************************
458 * The following function initializes the cpu_context for the current CPU
459 * for first use, and sets the initial entrypoint state as specified by the
460 * entry_point_info structure.
461 ******************************************************************************/
cm_init_my_context(const entry_point_info_t * ep)462 void cm_init_my_context(const entry_point_info_t *ep)
463 {
464 cpu_context_t *ctx;
465 ctx = cm_get_context(GET_SECURITY_STATE(ep->h.attr));
466 cm_setup_context(ctx, ep);
467 }
468
469 /*******************************************************************************
470 * Prepare the CPU system registers for first entry into realm, secure, or
471 * normal world.
472 *
473 * If execution is requested to EL2 or hyp mode, SCTLR_EL2 is initialized
474 * If execution is requested to non-secure EL1 or svc mode, and the CPU supports
475 * EL2 then EL2 is disabled by configuring all necessary EL2 registers.
476 * For all entries, the EL1 registers are initialized from the cpu_context
477 ******************************************************************************/
cm_prepare_el3_exit(uint32_t security_state)478 void cm_prepare_el3_exit(uint32_t security_state)
479 {
480 u_register_t sctlr_elx, scr_el3, mdcr_el2;
481 cpu_context_t *ctx = cm_get_context(security_state);
482 bool el2_unused = false;
483 uint64_t hcr_el2 = 0U;
484
485 assert(ctx != NULL);
486
487 if (security_state == NON_SECURE) {
488 scr_el3 = read_ctx_reg(get_el3state_ctx(ctx),
489 CTX_SCR_EL3);
490 if ((scr_el3 & SCR_HCE_BIT) != 0U) {
491 /* Use SCTLR_EL1.EE value to initialise sctlr_el2 */
492 sctlr_elx = read_ctx_reg(get_el1_sysregs_ctx(ctx),
493 CTX_SCTLR_EL1);
494 sctlr_elx &= SCTLR_EE_BIT;
495 sctlr_elx |= SCTLR_EL2_RES1;
496 #if ERRATA_A75_764081
497 /*
498 * If workaround of errata 764081 for Cortex-A75 is used
499 * then set SCTLR_EL2.IESB to enable Implicit Error
500 * Synchronization Barrier.
501 */
502 sctlr_elx |= SCTLR_IESB_BIT;
503 #endif
504 write_sctlr_el2(sctlr_elx);
505 } else if (el_implemented(2) != EL_IMPL_NONE) {
506 el2_unused = true;
507
508 /*
509 * EL2 present but unused, need to disable safely.
510 * SCTLR_EL2 can be ignored in this case.
511 *
512 * Set EL2 register width appropriately: Set HCR_EL2
513 * field to match SCR_EL3.RW.
514 */
515 if ((scr_el3 & SCR_RW_BIT) != 0U)
516 hcr_el2 |= HCR_RW_BIT;
517
518 /*
519 * For Armv8.3 pointer authentication feature, disable
520 * traps to EL2 when accessing key registers or using
521 * pointer authentication instructions from lower ELs.
522 */
523 hcr_el2 |= (HCR_API_BIT | HCR_APK_BIT);
524
525 write_hcr_el2(hcr_el2);
526
527 /*
528 * Initialise CPTR_EL2 setting all fields rather than
529 * relying on the hw. All fields have architecturally
530 * UNKNOWN reset values.
531 *
532 * CPTR_EL2.TCPAC: Set to zero so that Non-secure EL1
533 * accesses to the CPACR_EL1 or CPACR from both
534 * Execution states do not trap to EL2.
535 *
536 * CPTR_EL2.TTA: Set to zero so that Non-secure System
537 * register accesses to the trace registers from both
538 * Execution states do not trap to EL2.
539 * If PE trace unit System registers are not implemented
540 * then this bit is reserved, and must be set to zero.
541 *
542 * CPTR_EL2.TFP: Set to zero so that Non-secure accesses
543 * to SIMD and floating-point functionality from both
544 * Execution states do not trap to EL2.
545 */
546 write_cptr_el2(CPTR_EL2_RESET_VAL &
547 ~(CPTR_EL2_TCPAC_BIT | CPTR_EL2_TTA_BIT
548 | CPTR_EL2_TFP_BIT));
549
550 /*
551 * Initialise CNTHCTL_EL2. All fields are
552 * architecturally UNKNOWN on reset and are set to zero
553 * except for field(s) listed below.
554 *
555 * CNTHCTL_EL2.EL1PTEN: Set to one to disable traps to
556 * Hyp mode of Non-secure EL0 and EL1 accesses to the
557 * physical timer registers.
558 *
559 * CNTHCTL_EL2.EL1PCTEN: Set to one to disable traps to
560 * Hyp mode of Non-secure EL0 and EL1 accesses to the
561 * physical counter registers.
562 */
563 write_cnthctl_el2(CNTHCTL_RESET_VAL |
564 EL1PCEN_BIT | EL1PCTEN_BIT);
565
566 /*
567 * Initialise CNTVOFF_EL2 to zero as it resets to an
568 * architecturally UNKNOWN value.
569 */
570 write_cntvoff_el2(0);
571
572 /*
573 * Set VPIDR_EL2 and VMPIDR_EL2 to match MIDR_EL1 and
574 * MPIDR_EL1 respectively.
575 */
576 write_vpidr_el2(read_midr_el1());
577 write_vmpidr_el2(read_mpidr_el1());
578
579 /*
580 * Initialise VTTBR_EL2. All fields are architecturally
581 * UNKNOWN on reset.
582 *
583 * VTTBR_EL2.VMID: Set to zero. Even though EL1&0 stage
584 * 2 address translation is disabled, cache maintenance
585 * operations depend on the VMID.
586 *
587 * VTTBR_EL2.BADDR: Set to zero as EL1&0 stage 2 address
588 * translation is disabled.
589 */
590 write_vttbr_el2(VTTBR_RESET_VAL &
591 ~((VTTBR_VMID_MASK << VTTBR_VMID_SHIFT)
592 | (VTTBR_BADDR_MASK << VTTBR_BADDR_SHIFT)));
593
594 /*
595 * Initialise MDCR_EL2, setting all fields rather than
596 * relying on hw. Some fields are architecturally
597 * UNKNOWN on reset.
598 *
599 * MDCR_EL2.HLP: Set to one so that event counter
600 * overflow, that is recorded in PMOVSCLR_EL0[0-30],
601 * occurs on the increment that changes
602 * PMEVCNTR<n>_EL0[63] from 1 to 0, when ARMv8.5-PMU is
603 * implemented. This bit is RES0 in versions of the
604 * architecture earlier than ARMv8.5, setting it to 1
605 * doesn't have any effect on them.
606 *
607 * MDCR_EL2.TTRF: Set to zero so that access to Trace
608 * Filter Control register TRFCR_EL1 at EL1 is not
609 * trapped to EL2. This bit is RES0 in versions of
610 * the architecture earlier than ARMv8.4.
611 *
612 * MDCR_EL2.HPMD: Set to one so that event counting is
613 * prohibited at EL2. This bit is RES0 in versions of
614 * the architecture earlier than ARMv8.1, setting it
615 * to 1 doesn't have any effect on them.
616 *
617 * MDCR_EL2.TPMS: Set to zero so that accesses to
618 * Statistical Profiling control registers from EL1
619 * do not trap to EL2. This bit is RES0 when SPE is
620 * not implemented.
621 *
622 * MDCR_EL2.TDRA: Set to zero so that Non-secure EL0 and
623 * EL1 System register accesses to the Debug ROM
624 * registers are not trapped to EL2.
625 *
626 * MDCR_EL2.TDOSA: Set to zero so that Non-secure EL1
627 * System register accesses to the powerdown debug
628 * registers are not trapped to EL2.
629 *
630 * MDCR_EL2.TDA: Set to zero so that System register
631 * accesses to the debug registers do not trap to EL2.
632 *
633 * MDCR_EL2.TDE: Set to zero so that debug exceptions
634 * are not routed to EL2.
635 *
636 * MDCR_EL2.HPME: Set to zero to disable EL2 Performance
637 * Monitors.
638 *
639 * MDCR_EL2.TPM: Set to zero so that Non-secure EL0 and
640 * EL1 accesses to all Performance Monitors registers
641 * are not trapped to EL2.
642 *
643 * MDCR_EL2.TPMCR: Set to zero so that Non-secure EL0
644 * and EL1 accesses to the PMCR_EL0 or PMCR are not
645 * trapped to EL2.
646 *
647 * MDCR_EL2.HPMN: Set to value of PMCR_EL0.N which is the
648 * architecturally-defined reset value.
649 *
650 * MDCR_EL2.E2TB: Set to zero so that the trace Buffer
651 * owning exception level is NS-EL1 and, tracing is
652 * prohibited at NS-EL2. These bits are RES0 when
653 * FEAT_TRBE is not implemented.
654 */
655 mdcr_el2 = ((MDCR_EL2_RESET_VAL | MDCR_EL2_HLP |
656 MDCR_EL2_HPMD) |
657 ((read_pmcr_el0() & PMCR_EL0_N_BITS)
658 >> PMCR_EL0_N_SHIFT)) &
659 ~(MDCR_EL2_TTRF | MDCR_EL2_TPMS |
660 MDCR_EL2_TDRA_BIT | MDCR_EL2_TDOSA_BIT |
661 MDCR_EL2_TDA_BIT | MDCR_EL2_TDE_BIT |
662 MDCR_EL2_HPME_BIT | MDCR_EL2_TPM_BIT |
663 MDCR_EL2_TPMCR_BIT |
664 MDCR_EL2_E2TB(MDCR_EL2_E2TB_EL1));
665
666 write_mdcr_el2(mdcr_el2);
667
668 /*
669 * Initialise HSTR_EL2. All fields are architecturally
670 * UNKNOWN on reset.
671 *
672 * HSTR_EL2.T<n>: Set all these fields to zero so that
673 * Non-secure EL0 or EL1 accesses to System registers
674 * do not trap to EL2.
675 */
676 write_hstr_el2(HSTR_EL2_RESET_VAL & ~(HSTR_EL2_T_MASK));
677 /*
678 * Initialise CNTHP_CTL_EL2. All fields are
679 * architecturally UNKNOWN on reset.
680 *
681 * CNTHP_CTL_EL2:ENABLE: Set to zero to disable the EL2
682 * physical timer and prevent timer interrupts.
683 */
684 write_cnthp_ctl_el2(CNTHP_CTL_RESET_VAL &
685 ~(CNTHP_CTL_ENABLE_BIT));
686 }
687 manage_extensions_nonsecure(el2_unused, ctx);
688 }
689
690 cm_el1_sysregs_context_restore(security_state);
691 cm_set_next_eret_context(security_state);
692 }
693
694 #if CTX_INCLUDE_EL2_REGS
695 /*******************************************************************************
696 * Save EL2 sysreg context
697 ******************************************************************************/
cm_el2_sysregs_context_save(uint32_t security_state)698 void cm_el2_sysregs_context_save(uint32_t security_state)
699 {
700 u_register_t scr_el3 = read_scr();
701
702 /*
703 * Always save the non-secure and realm EL2 context, only save the
704 * S-EL2 context if S-EL2 is enabled.
705 */
706 if ((security_state != SECURE) ||
707 ((security_state == SECURE) && ((scr_el3 & SCR_EEL2_BIT) != 0U))) {
708 cpu_context_t *ctx;
709
710 ctx = cm_get_context(security_state);
711 assert(ctx != NULL);
712
713 el2_sysregs_context_save(get_el2_sysregs_ctx(ctx));
714 }
715 }
716
717 /*******************************************************************************
718 * Restore EL2 sysreg context
719 ******************************************************************************/
cm_el2_sysregs_context_restore(uint32_t security_state)720 void cm_el2_sysregs_context_restore(uint32_t security_state)
721 {
722 u_register_t scr_el3 = read_scr();
723
724 /*
725 * Always restore the non-secure and realm EL2 context, only restore the
726 * S-EL2 context if S-EL2 is enabled.
727 */
728 if ((security_state != SECURE) ||
729 ((security_state == SECURE) && ((scr_el3 & SCR_EEL2_BIT) != 0U))) {
730 cpu_context_t *ctx;
731
732 ctx = cm_get_context(security_state);
733 assert(ctx != NULL);
734
735 el2_sysregs_context_restore(get_el2_sysregs_ctx(ctx));
736 }
737 }
738 #endif /* CTX_INCLUDE_EL2_REGS */
739
740 /*******************************************************************************
741 * The next four functions are used by runtime services to save and restore
742 * EL1 context on the 'cpu_context' structure for the specified security
743 * state.
744 ******************************************************************************/
cm_el1_sysregs_context_save(uint32_t security_state)745 void cm_el1_sysregs_context_save(uint32_t security_state)
746 {
747 cpu_context_t *ctx;
748
749 ctx = cm_get_context(security_state);
750 assert(ctx != NULL);
751
752 el1_sysregs_context_save(get_el1_sysregs_ctx(ctx));
753
754 #if IMAGE_BL31
755 if (security_state == SECURE)
756 PUBLISH_EVENT(cm_exited_secure_world);
757 else
758 PUBLISH_EVENT(cm_exited_normal_world);
759 #endif
760 }
761
cm_el1_sysregs_context_restore(uint32_t security_state)762 void cm_el1_sysregs_context_restore(uint32_t security_state)
763 {
764 cpu_context_t *ctx;
765
766 ctx = cm_get_context(security_state);
767 assert(ctx != NULL);
768
769 el1_sysregs_context_restore(get_el1_sysregs_ctx(ctx));
770
771 #if IMAGE_BL31
772 if (security_state == SECURE)
773 PUBLISH_EVENT(cm_entering_secure_world);
774 else
775 PUBLISH_EVENT(cm_entering_normal_world);
776 #endif
777 }
778
779 /*******************************************************************************
780 * This function populates ELR_EL3 member of 'cpu_context' pertaining to the
781 * given security state with the given entrypoint
782 ******************************************************************************/
cm_set_elr_el3(uint32_t security_state,uintptr_t entrypoint)783 void cm_set_elr_el3(uint32_t security_state, uintptr_t entrypoint)
784 {
785 cpu_context_t *ctx;
786 el3_state_t *state;
787
788 ctx = cm_get_context(security_state);
789 assert(ctx != NULL);
790
791 /* Populate EL3 state so that ERET jumps to the correct entry */
792 state = get_el3state_ctx(ctx);
793 write_ctx_reg(state, CTX_ELR_EL3, entrypoint);
794 }
795
796 /*******************************************************************************
797 * This function populates ELR_EL3 and SPSR_EL3 members of 'cpu_context'
798 * pertaining to the given security state
799 ******************************************************************************/
cm_set_elr_spsr_el3(uint32_t security_state,uintptr_t entrypoint,uint32_t spsr)800 void cm_set_elr_spsr_el3(uint32_t security_state,
801 uintptr_t entrypoint, uint32_t spsr)
802 {
803 cpu_context_t *ctx;
804 el3_state_t *state;
805
806 ctx = cm_get_context(security_state);
807 assert(ctx != NULL);
808
809 /* Populate EL3 state so that ERET jumps to the correct entry */
810 state = get_el3state_ctx(ctx);
811 write_ctx_reg(state, CTX_ELR_EL3, entrypoint);
812 write_ctx_reg(state, CTX_SPSR_EL3, spsr);
813 }
814
815 /*******************************************************************************
816 * This function updates a single bit in the SCR_EL3 member of the 'cpu_context'
817 * pertaining to the given security state using the value and bit position
818 * specified in the parameters. It preserves all other bits.
819 ******************************************************************************/
cm_write_scr_el3_bit(uint32_t security_state,uint32_t bit_pos,uint32_t value)820 void cm_write_scr_el3_bit(uint32_t security_state,
821 uint32_t bit_pos,
822 uint32_t value)
823 {
824 cpu_context_t *ctx;
825 el3_state_t *state;
826 u_register_t scr_el3;
827
828 ctx = cm_get_context(security_state);
829 assert(ctx != NULL);
830
831 /* Ensure that the bit position is a valid one */
832 assert(((1UL << bit_pos) & SCR_VALID_BIT_MASK) != 0U);
833
834 /* Ensure that the 'value' is only a bit wide */
835 assert(value <= 1U);
836
837 /*
838 * Get the SCR_EL3 value from the cpu context, clear the desired bit
839 * and set it to its new value.
840 */
841 state = get_el3state_ctx(ctx);
842 scr_el3 = read_ctx_reg(state, CTX_SCR_EL3);
843 scr_el3 &= ~(1UL << bit_pos);
844 scr_el3 |= (u_register_t)value << bit_pos;
845 write_ctx_reg(state, CTX_SCR_EL3, scr_el3);
846 }
847
848 /*******************************************************************************
849 * This function retrieves SCR_EL3 member of 'cpu_context' pertaining to the
850 * given security state.
851 ******************************************************************************/
cm_get_scr_el3(uint32_t security_state)852 u_register_t cm_get_scr_el3(uint32_t security_state)
853 {
854 cpu_context_t *ctx;
855 el3_state_t *state;
856
857 ctx = cm_get_context(security_state);
858 assert(ctx != NULL);
859
860 /* Populate EL3 state so that ERET jumps to the correct entry */
861 state = get_el3state_ctx(ctx);
862 return read_ctx_reg(state, CTX_SCR_EL3);
863 }
864
865 /*******************************************************************************
866 * This function is used to program the context that's used for exception
867 * return. This initializes the SP_EL3 to a pointer to a 'cpu_context' set for
868 * the required security state
869 ******************************************************************************/
cm_set_next_eret_context(uint32_t security_state)870 void cm_set_next_eret_context(uint32_t security_state)
871 {
872 cpu_context_t *ctx;
873
874 ctx = cm_get_context(security_state);
875 assert(ctx != NULL);
876
877 cm_set_next_context(ctx);
878 }
879